EUVD-2026-98823
GHSA-wwvq-f4q5-r467
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnprivileged guest registers Xenstore watch with specified depth
-
DeliveryHost operator initiates Xenstore live update
-
ExploitWatch state record serialized missing two bytes
-
ExecutionNew C xenstored reads inconsistent state
-
ImpactXenstored crashes or corrupts, host domain-administration DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation is gated on all of the following: the host must run Xen 4.22 specifically (4.21 and earlier are not vulnerable) using the C implementation of xenstored, either as a daemon or stubdom (oxenstored is not affected); the attacker must be a guest that has registered a Xenstore watch with a specified watch depth; and - the decisive limiting factor - a Xenstore live update must actually be performed by the host while that watch exists, since the two-byte-short state record is only written during live-update serialization. The attacker does not control when live updates occur, so the window is operator-driven. Not performing Xenstore live updates fully mitigates the issue, as does switching to oxenstored. |
| Impact | No CVSS vector, EPSS score, KEV entry, or POC is present in the provided data, so quantitative exploitation signals are entirely absent and this assessment relies on the Xen Project advisory (XSA-514) text alone. The vendor-confirmed impact is a denial of service: an unprivileged guest can crash or corrupt the C xenstored service, disrupting host domain-administration actions - there is no confidentiality or code-execution impact described. Critically, the bug only manifests during a Xenstore live update, an administrator-initiated maintenance operation the attacker does not control, which sharply reduces real-world exploitability: the attacker can pre-position a malicious watch but must wait for (or race) an operator-triggered live update. The exposure is further narrowed to a single release (Xen 4.22) running C xenstored specifically. Net: this is a genuine but conditional availability issue, not a high-urgency widely-exploitable flaw - closer to a low-to-moderate real-world priority. Signals are consistent (all point to a gated DoS), but note the absence of any CVSS/EPSS/KEV data means severity cannot be corroborated independently and should be verified against the Xen Project's own rating if one is published. |
| Exploit ScenarioDerived | An unprivileged guest registers a Xenstore watch with a specified watch depth and leaves it in place. When the host operator later performs a Xenstore live update, the watch's state record is serialized with two bytes missing, so the newly started C xenstored reads back inconsistent state and either crashes or ends up with corrupted data, denying further domain-administration operations on the host. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Xen 4.22 hosts running the C implementation of xenstored (as daemon or stubdom) can have the entire Xenstore service crashed or returned with corrupted data when an unprivileged guest holds a Xenstore watch with a specified watch depth and the host performs a Xenstore live update, producing a host-level denial of service for further domain administration actions. The root problem is that the watch state record is serialized two bytes short, so the newly booted xenstored misreads the record and faults. Exploitation is heavily gated on operator behavior - it requires Xen 4.22 plus C xenstored, a guest-registered watch with a stated depth, and an actual live update occurring while that watch is live - consistent with the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H; no public exploit code exists and the issue is not in CISA KEV, with no EPSS or POC signals present in the available data. Only Xen 4.22 with C xenstored is affected; Xen 4.21 and earlier and installations using oxenstored are not vulnerable.
RemediationAI
Patch available per vendor advisory: XSA-514 ships xsa514.patch (sha256 8774d9b45db75851560db70a9be06d5e379311bd3042d9049bc29456e141ae7d) applying to xen-unstable - Xen 4.22.x, and the Xen Project notes that patches for released versions are prepared against the stable branches and may not apply cleanly to the most recent release tarball, so downstreams should update to the tip of the relevant stable branch before applying; see https://seclists.org/oss-sec/2026/q4/142 for the advisory and patch. If the fix cannot be deployed immediately, the advisory's own compensating controls are: do not perform a Xenstore live update (this fully avoids the issue but forfeits the ability to restart or upgrade xenstored without disrupting live domain administration, effectively forcing a maintenance window or reboot), or switch the host from C xenstored to oxenstored, which is not vulnerable because it uses a different serialization path (this requires a host-level configuration change and migration of the store, and the Xen Project flags the switch as a guest-visible configuration change, so it should be coordinated with any change-control or embargo constraints). No vendor-released patch version number beyond the XSA-514 patch itself was confirmed from the supplied data, and the issue should not be treated as reachable without the combination of Xen 4.22, C xenstored, an attacker-registered watch with a specified watch depth, and an operator-initiated live update.
Affected ProductsAI
Only Xen 4.22 (the xen-unstable/4.22.x line, with the fix delivered as xsa514.patch against xen-unstable - Xen 4.22.x) is affected, and only when the C implementation of xenstored is in use, whether run as a host daemon or as a stubdom. Systems running Xen 4.21 or older are not vulnerable, and systems running oxenstored are not vulnerable regardless of Xen version. No CPE identifiers, CVSS vector, EPSS score or CWE were supplied in the source data; the authoritative product statement is the Xen Project advisory XSA-514, mirrored on the oss-security list at https://seclists.org/oss-sec/2026/q4/142, with general process context in the Xen security policy at http://www.xenproject.org/security-policy.html.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Xenstore is the Xen control-plane key-value store that mediates configuration and control communication between the hypervisor, dom0 tooling and guests; guests interact with it through watches, which are registered interest callbacks tied to a path and, in the affected case, to an explicitly specified watch depth. Xenstore live update is a maintenance capability that serializes the running store's state into a record, restarts xenstored, and reads that record back so the store survives without tearing down domains. In Xen 4.22's C implementation of xenstored, the serialization path for a watch carrying a specified watch depth omits two bytes when writing the state record, so the deserialization performed by the replacement xenstored instance encounters an internally inconsistent structure and either crashes or reconstructs incorrect data. No CWE was included in the supplied data and no CVE-level CWE assignment is given here; the defect class is best characterized as improper handling of a length/field inconsistency during state serialization (cf. CWE-130), i.e. a producer/consumer mismatch between the record writer and reader rather than a memory-safety primitive such as a classic overflow. The affected component is only the C xenstored (deployed either as a host daemon or as a stubdom); the OCaml-based oxenstored implements this path differently and is explicitly not vulnerable.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Guest-local attacker (AV:L) needing a running domain (PR:L); exploitation hinges on an operator-triggered live update outside attacker control (AC:H); guest crashes host service (S:C), causing DoS (A:H) and possible data corruption (I:L), no confidentiality loss.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Executive ViewAI
CVE-2026-79607 is a HIGH-severity defect affecting Xen 4.22 hosts that run the C implementation of xenstored (as a daemon or stubdom): an unprivileged guest holding a live Xenstore watch of a particular depth, combined with an operator-initiated Xenstore live update, can crash or corrupt Xenstore on the host and halt further domain administration. Because Xenstore is the control plane for guest configuration and lifecycle operations, a successful trigger can disrupt provisioning, migration, and recovery across all workloads on the impacted hypervisor. Leadership should note that no vendor patch is currently available and that exposure depends on day-to-day maintenance practices, making this primarily an operational-risk and change-control matter.
No vendor-released patch identified at time of analysis. Interim mitigations: suspend or defer Xenstore live updates on Xen 4.22 hosts running C xenstored until a fix is available; migrate to an unaffected xenstored implementation where the vendor confirms it is not impacted; restrict any unavoidable live updates to controlled maintenance windows with change approval; and monitor for xenstored crashes or corrupted Xenstore data so operations can be halted and recovered quickly.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB